Aaron Shelmire

[CV.YH @0xCVYH]

Laya é um open source do Jev que já veio acima dele.

tá cada vez mais rápido

https://t.co/XVyFYPxVht

[Marc Brooker @MarcJBrooker]

There's been a ton of talk about the role of humans in code review, and when and how humans should be signing off on changes.

I believe that, long-term, humans have no role in routinely reviewing code.

[Seongsu Park @unpacker]

Great deep dive from the GitLab team on DPRK’s "Contagious Interview" and illicit IT worker campaign. This isn’t just a surface-level write-up. It shows how a platform can operationalize its own telemetry, extract high-signal intelligence, and convert that into concrete, actionable insights for the broader security community. Seriously impressive work. 👏
Blog: https://t.co/B9pPZwaiuv

If you want even more context, the Three Buddy Problem podcast did a great breakdown of the blog and unpacked the tradecraft, detection implications, and what this means for defenders. TBP is basically my go-to weekend running podcast, so it was extra cool to hear them dive into this and appreciate the shoutout me, guys. 🙇‍♂️

TBP Podcast: https://t.co/fFZyUxhFYz

[Aaron Shelmire @AShelmire]

@__paleologo @halvarflake Hamming indeed. Hammond’s book would have calculations of clarksons swear words per minute and speed estimates for the stig on roads.

[Censys @censysio]

🚨 Censys on #React2Shell (CVE-2025-55182): We observe ~2.15M exposed web services running Next.js or other RSC-based frameworks—mostly in the U.S. and China. Not all are vulnerable, but active exploitation is underway. Patch now.

👉 Full advisory: https://t.co/InIZwIyNM1

[Aaron Shelmire @AShelmire]

Very clever - with this approach I wonder if you’ll get the data from werfaultsecure.exe or if that will be frozen too?

Are the only detections around this device reporting, or collecting telemetry from multiple sources (eg osquery + agent + event logs)?

[blackorbird @blackorbird]

A new evasion technique known as "EDR-Freeze" has emerged, changing the way attackers neutralize endpoint security. Unlike traditional methods that attempt to crash or terminate security software (which often triggers alerts), EDR-Freeze suspends the security process entirely, rendering it "comatose" but technically alive. This attack is particularly dangerous because it operates entirely in user mode, meaning it does not require the attacker to bring a vulnerable driver (BYOVD) or exploit kernel-level flaws. Instead, it abuses legitimate Windows error reporting tools to freeze Endpoint Detection and Response (EDR) agents, creating a blind spot where malicious activity can occur undetected.

https://t.co/60aVeVHl2V

[blackorbird @blackorbird]

A new evasion technique known as "EDR-Freeze" has emerged, changing the way attackers neutralize endpoint security. Unlike traditional methods that attempt to crash or terminate security software (which often triggers alerts), EDR-Freeze suspends the security process entirely, rendering it "comatose" but technically alive. This attack is particularly dangerous because it operates entirely in user mode, meaning it does not require the attacker to bring a vulnerable driver (BYOVD) or exploit kernel-level flaws. Instead, it abuses legitimate Windows error reporting tools to freeze Endpoint Detection and Response (EDR) agents, creating a blind spot where malicious activity can occur undetected.

https://t.co/60aVeVHl2V

[blackorbird @blackorbird]

An Insider Look At The APT35 Operations
https://t.co/9dUrE4WWh4

[blackorbird @blackorbird]

Massive APT35 (Charming Kitten)
internal leak exposes a highly mature, quota-driven cyber-espionage machine focused on long-term mailbox persistence & HUMINT collection.
Core technical tradecraft is Exchange-centric & credential-obsessed:
Initial Access & Exploitation
• Heavy reliance on ProxyShell chains (CVE-2021-34473/34523/31207), Autodiscover proxying, EWS enumeration, and PowerShell automation to drop https://t.co/GRPGKLiB4J webshells (predictable paths: aspnet_client/, owa/auth/, often named m0s.aspx, m0s.php).
• Ivanti Connect Secure CVE weaponization playbooks that turn appliance vulns into reliable RCE for pivoting to internal mail estates.
• Broad recon → curated target queues: mass scanning for exposed OWA/EWS, .env grabs, RDP mstshash probes, WordPress enumeration — all feeding annotated ProxyShell target lists per country.
Credential Harvesting & Reuse
• LSASS dumps via Mimikatz-style tools (real example: plaintext creds + NTLM hashes from mfa.kktc in 2022).
• OAuth token replay, delegated token abuse, and AiTM-style MFA bypass in HERV phishing kits.
• GAL exports immediately weaponized: harvested address books → personalized HERV lures → new credentials → repeat cycle.
Persistence & Lateral Movement
• Credential-driven over fragile shells: token persistence + credential reuse for months-long access even after patches.
• WMI + WMIC remote execution, SMB admin$ mounts (net use \IP\C$), scheduled tasks, and in-memory PowerShell loaders.
• Custom in-house RAT family (RAT-2Ac2 / “PowerShort”) dropped to C:\ProgramData\Microsoft\diagnostic\ as vmware-tools.exe or JavaUpdateServices.exe — full-featured with keylogger, browser stealer, file collection, encrypted C2.
Operator Tooling & C2
• Lightweight Python REPL clients (https://t.co/sSf5t81xrC, https://t.co/1Mh3YDa1I4, https://t.co/GwgqwR7vMV) that control webshells by stuffing commands into Accept-Language headers + static Accept-Captcha handshake token (high-confidence network signature).
• Exfil via 7z to Mega/Dropbox/ProtonDrive, compromised Exchange SMTP relays, DNS tunneling, or direct HTTP beacons to C2 (e.g., 103.57.251.153).
Phishing (HERV framework)
• Mature, KPI-tracked phishing unit: HTML credential harvesters, localized templates, success metrics (lures sent, creds captured, mailbox dwell time).
• Closed-loop integration: GALs from Exchange hacks directly seed the next phishing wave.
Infrastructure & OPSEC
• Staging from Iranian DSL (Pishgaman, Zitel AS50810) + clean international VPS relays (Singapore RIPE 128.199.237.132, etc.) to separate operator origin from victim traffic.
• Internal comms: Output Messenger, 3CX, Issabelle for task hand-off.
Detection gold from the leak:
• Hunt for m0s.* webshells + long/obfuscated Accept-Language headers
• ProgramData\Microsoft\diagnostic\vmware-tools.exe / JavaUpdateServices.exe execution
• Static Accept-Captcha token in traffic
• Anomalous GAL exports + sudden HERV-style phishing spikes
This isn’t opportunistic hacking — it’s industrialized, repeatable intelligence collection run like a factory with daily KPIs, supervisor sign-offs, and specialized cells (exploit dev → credential team → HERV phishing → RTM monitoring).
Defenders: patch Exchange/Ivanti aggressively, enforce phishing-resistant MFA (FIDO2), monitor EWS/GAL activity, and hunt the repeatable signatures above. The bureaucratic rhythm makes them efficient but predictable.
Full DomainTools report: https://t.co/x5vUHE4TaO
#APT35 #CharmingKitten #IRGC #CyberEspionage #ThreatIntel

[Aaron Shelmire @AShelmire]

@anton_chuvakin Good post - Largely see your points - though not fully following why federated fails compliance tests - can you expand on that point?

[Aaron Shelmire @AShelmire]

@cyb3rops are you aware of any (many?) folks using sigma and then expanding the language to cover more capabilities that are in their detection platforms? like sigma + an expansion pack?

[chrisrohlf @chrisrohlf]

Theres an interesting similarity between frontier AI model training and 0-day exploit development. You spend months in secret using custom techniques to explore emergent behaviors and properties, undocumented constraints and behaviors in a poorly understood system, all with no guarantees you’ll be successful. You’re on the lookout for leaks, operational security missteps, shifting baselines and requirements. And in the end some other team beats you to the finish line, and in a moment renders months of your work meaningless.

[Jaana Dogan ヤナ ドガン @rakyll]

There is no moat other than hardware. Everything is proven to be fungible. Models, data, infrastructure, deep integrations, …

Apart from hardware, attracting the world’s best researchers and engineers is the other clear answer if you give them a productive environment.

[Aaron Shelmire @AShelmire]

@anton_chuvakin Kind of the flipside - there are also ppl who thrive managing (or performing generally) in those high-stress environments, who struggle in the fair weather environments. I think I saw this referred to in Eng terms as war-time vs peace-time.

[Aaron Shelmire @AShelmire]

@ImposeCost though caution: correlation != causation.

It would be super cool to see if you all could reproduce and/or see what the state of today is.

one draft of the preso: https://t.co/ZSvO8Y9ycN

[Aaron Shelmire @AShelmire]

@ImposeCost tl;dr - mid-2010s seems physical world actions and bot takedowns had the most impact, and often led to a rise in activity as the actors may have tried to re-capture market share - either after mules arrested or botnets taken down.

[Aaron Shelmire @AShelmire]

Curious - we’ve been seeing AWS EKS calls run about 2-4x slower than normal. Is anyone else seeing this? Possibly Black Friday related?

[Aaron Shelmire @AShelmire]

Very much agree with this perspective. AI/ML will become de rigueur in most tools, allowing for more time spent on custom analysis - the hard part and what we don’t want to repeat is generating 2012-2016s overwhelming false positive flood of UEBA alerts.

[Steve YARA Synapse Miller @stvemillertime]

@HostileSpectrum Imo, because ML applications will be widely commercialized, outputs therefrom will effectively become *commoditized* (and quite "mid", as the kids say), which will then skyrocket the value of creative, artisanal, bench-made, human-generated content.